You are viewing a plain text version of this content. The canonical link for it is here.

Posted to bugs@httpd.apache.org by bu...@apache.org on 2019/01/04 14:54:02 UTC

[Bug 60739] SSLProtocol settings seem to have no effect

https://bz.apache.org/bugzilla/show_bug.cgi?id=60739

--- Comment #24 from Arne K. Haaje <ar...@drlinux.no> ---
I can confirm this behaviour on 2.4.37 on two servers. I'm using these
directives, and TLSv1.0 is still available

SSLHonorCipherOrder on
        SSLCipherSuite "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384
EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH
EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS !DES !IDEA !RC2"

SSLProtocol -All +TLSv1.1 +TLSv1.2


nmap --script ssl-enum-ciphers -p 443 xxx.xxx.xxx.xxx | grep TLSv
|   TLSv1.0:
|   TLSv1.1:
|   TLSv1.2:

-- 
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org